Send traces elsewhere

Get AgentFox's decisions and issues into the tools your team already watches, and your existing traces into AgentFox.

Destination	What you get	Turn it on
OpenTelemetry (in)	Agents you already trace show up for review, without code changes. Recorded, not checked.	Point your OTLP/HTTP exporter at `<server>/v1/traces`. Settings → Connections → OpenTelemetry shows the setup. Details
Langfuse, LangSmith	Find the AgentFox decision behind one of their traces, and tag their run with the verdict.	Send calls through the proxy with their trace header. To tag runs, set `AGENTFOX_CORRELATION_PUSH=true` and their keys. Details
Prometheus	Decisions, detector health and open issues as metrics.	Scrape `<server>/metrics`. Details
SIEM (Splunk, ArcSight, QRadar)	Decisions and issues as JSON lines, CEF, LEEF or OTLP logs.	Fetch `<server>/api/export/siem?format=cef` on a schedule. Details
Webhook	A signed POST when an issue is raised, resolved or reopened.	`AGENTFOX_WEBHOOK_URL` and `AGENTFOX_WEBHOOK_SECRET`. Details
Slack (Enterprise)	A message when monitoring opens or closes an issue.	Settings → Alerts → Slack, or `AGENTFOX_SLACK_WEBHOOK_URL`.

Settings, Alerts: a Slack webhook, monitors, and the SIEM export command.

Try a webhook

Set the variables on the server, restart it, and raise an issue (an agent nobody registered does it). Your receiver should check the X-AgentFox-Signature header: an HMAC-SHA256 of the raw body with your secret.

bash

export AGENTFOX_ALLOW_EGRESS=true
export AGENTFOX_WEBHOOK_URL=https://hooks.example.com/agentfox
export AGENTFOX_WEBHOOK_SECRET=whsec_…
export AGENTFOX_WEBHOOK_MIN_SEVERITY=high

Good to know

Spans sent to /v1/traces are recorded but not checked. To block, route calls through agentfox.auto() or the proxy.
The _total metrics count the last 24 hours, so they can go down. Alert on the value, such as agentfox_detector_degraded_total > 0, not on rate().
A webhook is retried once, then dropped. Use the SIEM export to backfill.
Outside development, /api/export/siem and /v1/traces need a token or agent key. /metrics is open: keep it on a private network.

If something goes wrong

You see	Do this
No webhook arrives	Set `AGENTFOX_ALLOW_EGRESS=true`, and check the issue's severity against `AGENTFOX_WEBHOOK_MIN_SEVERITY`.
`/v1/traces` returns 415	Install `agentfox[otel]` on the server for protobuf, or export JSON.
`/api/traces/resolve` returns 404	The call did not go through the proxy with a Langfuse, LangSmith or `traceparent` header.

Send traces elsewhere

Get AgentFox's decisions and issues into the tools your team already watches, and your existing traces into AgentFox.

Destination

What you get

Turn it on

OpenTelemetry (in)

Agents you already trace show up for review, without code changes. Recorded, not checked.

Point your OTLP/HTTP exporter at <server>/v1/traces. Settings → Connections → OpenTelemetry shows the setup. Details

Langfuse, LangSmith

Find the AgentFox decision behind one of their traces, and tag their run with the verdict.

Send calls through the proxy with their trace header. To tag runs, set AGENTFOX_CORRELATION_PUSH=true and their keys. Details

Prometheus

Decisions, detector health and open issues as metrics.

Scrape <server>/metrics. Details

SIEM (Splunk, ArcSight, QRadar)

Decisions and issues as JSON lines, CEF, LEEF or OTLP logs.

Fetch <server>/api/export/siem?format=cef on a schedule. Details

Webhook

A signed POST when an issue is raised, resolved or reopened.

AGENTFOX_WEBHOOK_URL and AGENTFOX_WEBHOOK_SECRET. Details

Slack (Enterprise)

A message when monitoring opens or closes an issue.

Settings → Alerts → Slack, or AGENTFOX_SLACK_WEBHOOK_URL.

Try a webhook

bash

export AGENTFOX_ALLOW_EGRESS=true
export AGENTFOX_WEBHOOK_URL=https://hooks.example.com/agentfox
export AGENTFOX_WEBHOOK_SECRET=whsec_…
export AGENTFOX_WEBHOOK_MIN_SEVERITY=high

Good to know

Spans sent to /v1/traces are recorded but not checked. To block, route calls through agentfox.auto() or the proxy.

The _total metrics count the last 24 hours, so they can go down. Alert on the value, such as agentfox_detector_degraded_total > 0, not on rate().

A webhook is retried once, then dropped. Use the SIEM export to backfill.

Outside development, /api/export/siem and /v1/traces need a token or agent key. /metrics is open: keep it on a private network.

If something goes wrong

You see

Do this

No webhook arrives

Set AGENTFOX_ALLOW_EGRESS=true, and check the issue's severity against AGENTFOX_WEBHOOK_MIN_SEVERITY.

/v1/traces returns 415

Install agentfox[otel] on the server for protobuf, or export JSON.

/api/traces/resolve returns 404

The call did not go through the proxy with a Langfuse, LangSmith or traceparent header.